TL;DR: Onyx Security’s $40 million round and Guardian Agent pitch spotlight a larger issue: behavioral monitoring can flag suspicious AI activity, but it cannot prove whether an agent was authorised to touch a system, according to EnforceAuth. The practical problem is the authorization gap between authentication and deterministic enforcement, especially across AI agents, service accounts, and delegated access chains.
At a glance
What this is: This analysis separates AI agent behavioural monitoring from authorization enforcement and argues that the real governance failure is proving what an agent was permitted to do, not merely detecting what it did.
Why it matters: IAM, IGA and PAM teams need this distinction because AI agents inherit access through human delegation and NHI credentials, so auditability depends on deterministic authorization trails across the full identity chain.
Context
AI agent governance fails when organisations treat behavioural oversight as a substitute for authorization. In practice, a system can notice that an agent looks suspicious and still be unable to prove whether that action was ever permitted under policy.
That gap matters most where AI agents act through service accounts, API keys, OAuth tokens, and delegated human approvals. The control problem is not only whether the agent is acting strangely, but whether the surrounding identity chain can produce a deterministic authorization record.
Key questions
Q: What breaks when AI agent monitoring is treated as an authentication control?
A: Access governance breaks because the organisation learns what the agent did, but not whether the agent should have been able to enter in the first place. Monitoring can support detection and investigation, but it cannot narrow delegated scope, enforce identity proofing, or prevent over-permissioned access from existing.
Q: Why do delegated AI agent chains increase access risk?
A: Because each hop can lose the original task boundary. If identity and scope are not propagated across delegation, downstream agents may inherit access that no longer matches the initiating purpose. The result is scope drift, where the chain still looks legitimate in traces but is no longer governed by the same access decision.
Q: What are the signs that behavioral AI monitoring is being overused as a control?
A: The warning signs are vague deny reasons, no durable policy trail, and security teams relying on alerts to justify access after the fact. If a system cannot produce a deterministic allow or deny record for a given action, it is functioning as observation, not enforcement. That is a governance gap, not a tuning issue.
Q: What is the difference between AI agent behaviour monitoring and authorization enforcement?
A: Behaviour monitoring asks whether an action looks abnormal. Authorization enforcement asks whether the action was permitted in the first place and records the decision in a way auditors can verify. The first is probabilistic and useful for detection. The second is deterministic and necessary for governance, accountability, and policy compliance.
Technical breakdown
Control planes monitor behaviour, not entitlement
A control plane observes runtime activity and decides whether an action looks acceptable based on signals, anomaly patterns, or learned behaviour. That is useful for detection, but it is not the same as authorization, which evaluates an action against explicit policy before execution. In identity terms, behaviour is a moving target while entitlement is a recorded rule. When teams collapse those two layers, they end up with tools that can explain suspicious activity after the fact but cannot prove whether the action should have been allowed in the first place.
Practical implication: Use behavioural controls as a monitoring layer, not as evidence of authorization.
Deterministic policy requires a complete identity chain
Authorization only becomes auditable when each step in the delegation chain is visible: the human who approved the access, the AI agent that used it, and the non-human credentials that carried the request. If any link is missing, the policy decision cannot be reconstructed cleanly for auditors or incident responders. This is especially important in environments where service accounts, OAuth tokens, and API keys outnumber human identities and are inherited by agents through indirect trust relationships.
Practical implication: Record the full delegation path whenever an AI agent or NHI is granted access.
Probabilistic oversight cannot replace policy-as-code
Supervisory AI can estimate whether an action seems risky, but it remains probabilistic and therefore vulnerable to false positives, prompt manipulation, or adversarial bypass. Policy engines such as Rego or Cedar work differently: they return a deterministic allow or deny decision, and every decision can be logged and reviewed. That difference is central to enterprise governance because regulators and auditors need explainable evidence, not confidence scores. The governance issue is not whether the model is smart enough, but whether the enforcement path is provable.
Practical implication: Keep enforcement in policy code and reserve AI for supplementary review and anomaly detection.
Threat narrative
Attacker objective: The objective is to access and manipulate enterprise resources through a trust chain that lacks deterministic authorization evidence.
- Entry occurs when an AI agent is granted access through a delegated human approval or inherited NHI credential without a provable authorization trail.
- Credential abuse follows when the agent uses service accounts, OAuth tokens, or API keys to reach resources that have not been explicitly governed at the policy layer.
- Escalation appears when the delegated chain expands across multiple resources and the organisation cannot reconstruct who authorized each step or whether the permissions were appropriate.
- Impact is audit failure, uncontrolled data access, and a governance blind spot that behavioral monitoring cannot remedy after the fact.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Authorization and authentication are no longer sufficient as separate checkpoints: The article is right that enterprises have over-invested in proving identity while under-governing what that identity may do. In AI agent environments, the control failure is not merely weak detection but a missing authorization record that can survive audit, incident review, and regulatory scrutiny. Practitioners should treat deterministic authorization as the baseline control plane and behavioural monitoring as a secondary signal, not the reverse.
Delegation chains create the real governance surface: A human who delegates to an AI agent, which then uses service accounts or OAuth tokens, creates a composite identity path that many IAM programmes still do not model. That path crosses human IAM, NHI governance, and agentic behaviour in one decision chain. The implication is that authorization cannot be assessed at only one layer, because the weakest handoff determines the governance outcome.
Policy engines solve a different problem than supervisory AI: The key distinction is not technical sophistication, but evidentiary quality. A probabilistic monitor can help with triage, yet only policy-as-code produces the deterministic allow-or-deny trail that auditors and security operations can rely on. The practical conclusion is that organisations need evidence-grade authorization for AI workloads, not merely runtime suspicion detection.
Ephemeral AI control is an identity governance problem, not a model problem: Authorization receipts for autonomous-seeming workflows: The article exposes a governance assumption that authorization can be inferred from observed behaviour. That assumption fails when AI agents act through inherited privileges and delegated access paths that outlive the review that created them. The implication is that identity governance must measure permissions at issuance and delegation time, not after activity has already occurred.
AI agent governance will converge with broader NHI controls: The same over-privilege, delegation, and lifecycle issues that plague service accounts now apply to AI agents that consume those identities. That convergence means security teams cannot build a separate governance model for agents that ignores the existing NHI estate. Practitioners should align AI agent controls with NHI lifecycle and authorization disciplines rather than create a parallel silo.
From our research library:
- Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.
- Read next: AI Agent Identity Security Buyer's Guide
What this signals
Authorization receipts will become the governing evidence for AI agents: As agents inherit permissions from service accounts, OAuth tokens, and delegated human approvals, the security question shifts from detection to provability. A programme that cannot show who authorized each action will struggle to defend its access model, even if behavioural monitoring is in place.
A separate AI control layer does not remove the need for NHI lifecycle discipline. The practical boundary is clear: if the identity chain cannot explain its own permissions, the organization has a governance problem that no anomaly model can solve.
For practitioners
- Define deterministic authorization for agent actions Require every AI agent action to resolve against an explicit policy before execution, with a logged decision and attributable policy source.
- Map the full delegation chain Document the human approver, the agent, and every NHI credential involved so auditors can reconstruct who authorized each step.
- Separate behavioural monitoring from enforcement Keep anomaly detection in the monitoring stack, but do not let it substitute for policy-backed allow and deny decisions.
- Inventory over-privileged NHIs used by agents Review service accounts, API keys, OAuth tokens, and pipeline credentials that agents inherit and remove permissions that no longer match current use.
Key takeaways
- AI agent governance fails when organisations mistake behavioural monitoring for authorization, because suspicious activity detection does not prove entitlement.
- The real evidence problem sits in the delegation chain, where human approvals, agent actions, and NHI credentials must all be auditable together.
- Deterministic policy enforcement is the control that closes the gap, while monitoring remains a supplementary signal rather than the source of authorization truth.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on AI agents using delegated privileges without clear authorization. |
| Recommendation — Map agent access paths to ASI03 and enforce explicit privilege boundaries before execution. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article distinguishes authentication from the missing authorization layer for non-human identities. |
| NHI-05 — Overprivileged NHI | Service accounts and tokens inherited by agents are described as likely over-privileged. | |
| Recommendation — Separate identity proofing from permission enforcement and log every authorization decision. Review NHI permissions for excess access and reduce inherited privileges to the minimum needed. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article discusses lifecycle control of service accounts, keys, and tokens used by agents. |
| Recommendation — Apply IA-5 to manage NHI authenticators, rotate stale credentials, and revoke unused access. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes credentials and delegated access as the path to broader resource reach. |
| Recommendation — Track credential use and delegation expansion to detect access that moves beyond intended scope. | ||
Key terms
- Authorization Gap: The distance between what an authenticated identity can do and what it is actually permitted and proven to do in real time. For AI agents, the gap widens when decisions are made per action, at machine speed, and through workflows that expand faster than human review cycles.
- Control Plane: The control plane is the set of actions that create, configure, or manage a service. For AI workloads, it covers deployment and administration of the model platform, while data-plane permissions govern what the service and its identities can read or process.
- Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
- Policy as Code: Policy as code stores authorization logic in version control and evaluates it through testable, reviewable rules. For agent governance, it makes runtime decisions reproducible and measurable, which is critical when actions can be triggered by untrusted content and executed at machine speed.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 10, 2026.
Updated on October 10, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org